(aws-lambda): Use PoLP inline IAM policies instead of AWS managed policies

[LyndonHook]

Describe the feature

Lambdas are created with inline policies that follow PoLP instead of AWS managed policies.

Use Case

Currently Lambdas are created with AWS managed policies for logging and VPC access.

AWS managed policies used by the CDK:

• AWSLambdaBasicExecutionRole
• AWSLambdaVPCAccessExecutionRole

In most cases AWS managed policies are considered overly permissive and customer managed policies should be used in their place.

Lambdas should be created with sensible defaults based on AWS best practices.

Proposed Solution

The CDK creates Lambdas without using AWS managed policies. Instead, it uses custom inline policies based on the PoLP.

Other Information

Existing GitHub discussion

Acknowledgements

• I may be able to implement this feature request
• This feature might incur a breaking change

CDK version used

2.162.1

Environment details (OS name and version, etc.)

Ubuntu 24.04.1

[pahud]

Thank you for bringing this up to our attention. I'll check with the team and see if there's any update for this.

[5d]

Hi @LyndonHook,

I'm looking into solutions for this issue and will keep you updated as soon as I have more information.